1. Field of the Invention
The present invention relates to computer system security. More specifically, the present invention relates to a method and apparatus for facilitating multi-level computer system authentication.
2. Related Art
Today, the most common form of computer system authentication is the basic computer system login. In a typical computer system login sequence, the user provides a user identifier and a credential that matches the user. Typically, the credential is a user-selected password. Generally, this does not provide a very high level of security due to the relatively insecure nature of passwords.
Biometrics solves many of the problems associated with the basic computer system login. However, most users are uncomfortable with biometric solutions, because they are often viewed as invasive. Furthermore, the level of security provided by biometrics drops significantly when the user attempts a remote login. In most cases biometrics are not available for remote authentication which leaves a computer administrator with two choices, either (1) settle for decreased security or (2) deactivate remote logins. In most environments, neither of these choices is an acceptable solution.
Smart cards are not as invasive as biometrics, but for remote logins smart cards suffer from similar drawbacks. For example, the level of security drops for remote logins and smart card readers are not always available at locations to allow remote logins. Additionally, there is a risk that the smart cards could be lost or stolen.
One-time passwords are another solution, but they increase overhead in terms of both user time and resources required to generate one-time passwords. Overhead is increased even further by the resources required to provide the one-time passwords to the user and then to validate the one-time password when they are used. Moreover, information that a user provides to obtain a one-time password can be intercepted by adversaries who, upon acquiring the information, can obtain their own one-time password.
Organizations typically restrict the manner in which different users can access various computer system resources and applications. This typically involves authenticating users every time they attempt to access a new system and/or resource, or verifying permission and/or privilege levels. These operations can generate a significant amount of overhead because resources must be used to perform the authentication and privilege checks.
Company policies are often difficult to enforce. A user may have permission to access a computer system, but the company might want to restrict the user from accessing certain machines, such as a central server. Using different authentication systems for different computers increases overhead. If a user's access to different computer systems changes, each authentication system must be separately updated to account for the change in a user's ability to access the system, which may involve adding or removing the user from the authentication system.
Additionally, a company may want to restrict remote login for one user, but not for another. For example, the CEO might be granted access to all systems regardless of the CEO's location, but a new employee might only be granted access from within the company's walls.
While security is important, it is not the only concern that can be addressed by systems that restrict access to computer systems. A company may want to restrict which users can login at certain peak periods in order to prevent excessive system load. For example, a company might want to prevent most users from logging into machines during a system upgrade, but may allow a few selected users to login for emergency purposes.
Hence, what is needed is a method for authenticating users at a computer system without the problems listed above.